Your current environment

Not applicable (CI configuration issue, not runtime environment related)

🐛 Describe the bug

I identified CI/CD security issue related to an unpinned third-party GitHub Action.

Finding

The macOS workflow uses a third-party action pinned to a mutable tag:

• File: .github/workflows/macos-smoke-test.yml
• Line: 20
• Usage:

uses: astral-sh/setup-uv@v7

Using mutable tags (e.g., @v7, @main, @latest) introduces a supply chain risk. These tags can be force-updated to point to different commits at any time. If the upstream repository is compromised, malicious code could be executed in CI without any visible changes in this repository.

Scan Logs

The issue was identified using Runner Guard:

Runner Guard v2.9.0 | Vigilant
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Fetching workflows from github.com/vllm-project/vllm...
Scanning 6 workflow files...
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[LOW] RGS-007 — Unpinned Third-Party Action Using Mutable Tag
File:     macos-smoke-test.yml (line 20)
Job:      macos-m1-smoke-test

Evidence: Third-party action pinned to mutable ref 'v7': astral-sh/setup-uv@v7
(job has read-only permissions, reducing impact)

Summary: 0 Critical | 0 High | 0 Medium | 1 Low

Runner Guard Score: 94/100 (A)
  Pinning:      7/10  (1 unpinned action(s))
  Permissions:  10/10  (no issues detected)
  Injection:    10/10  (no issues detected)
  Triggers:     10/10  (no issues detected)
  IOCs:         10/10  (no issues detected)

Scan completed in ~3.5s

Impact

This appears to be low severity due to read-only permissions in the job. However, similar issues have been exploited in real-world supply chain attacks where attackers hijack mutable tags to execute malicious code in CI pipelines.

Recommendation

Pin the action to a full commit SHA to ensure immutability:

uses: astral-sh/setup-uv@<commit-sha>

Example:

uses: astral-sh/setup-uv@a1b2c3d4e5f6...

Notes

• Pinning prevents tag hijacking and supply chain attacks
• This vulnerability class was actively exploited in the March 2026 attacks against litellm, trivy, and other major open-source projects
• Tools like Dependabot or Renovate can help keep pinned SHAs updated
• This is a best-practice improvement for CI security hardening

Before submitting a new issue...

• Make sure you already searched for relevant issues, and asked the chatbot living at the bottom right corner of the documentation page, which can answer lots of frequently asked questions.